mainline inclusion from mainline-v7.3-rc1 commit 888d33b208bd6929808abdc0728e3e5f744b60dc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19119 CVE: CVE-2026-90042 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- ceph_fname_to_usr() needs a temporary buffer for some operations (currently only base64-decoding ciphertext) and it is convenient to allow the caller to specify this buffer to avoid a heap allocation, so it has a (nullable) tname argument. Until now, this argument was a struct fscrypt_str; however, this is unnecessary for two reasons: 1. tname->len isn't used anywhere: ceph_fname_to_usr() assumes a buffer large enough to hold the ciphertext, and parse_reply_info_readdir() -- the only caller to use tname -- doesn't set it. 2. While the tname parameter is documented "may be NULL," parse_reply_info_readdir() always passes it but with tname->name sometimes NULL in violation of the contract, indicating that the unnecessary container creates actual confusion. Therefore, change the type to unsigned char * and pass the buffer directly. Upstream commit 888d33b208bd Signed-off-by: Sam Edwards <CFSworks@gmail.com> Reviewed-by: Alex Markuze <amarkuze@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Conflicts: fs/ceph/crypto.c fs/ceph/mds_client.c [Commit b1b72ac25f891 ("ceph: replace local base64 helpers with lib/base64") is not present in this tree, so keep using ceph_base64_decode() instead of base64_decode(). Context conflicts in fs/ceph/mds_client.c] Signed-off-by: Pan Taixi <pantaixi1@huawei.com> --- fs/ceph/crypto.c | 8 ++++---- fs/ceph/crypto.h | 4 ++-- fs/ceph/mds_client.c | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c index b0337c4b1bd7..78014e091c4f 100644 --- a/fs/ceph/crypto.c +++ b/fs/ceph/crypto.c @@ -367,11 +367,11 @@ int ceph_encode_encrypted_fname(struct inode *parent, struct dentry *dentry, * Otherwise, base64 decode the string, and then ask fscrypt to format it * for userland presentation. * * Returns 0 on success or negative error code on error. */ -int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname, +int ceph_fname_to_usr(const struct ceph_fname *fname, unsigned char *tname, struct fscrypt_str *oname, bool *is_nokey) { struct inode *dir = fname->dir; struct fscrypt_str _tname = FSTR_INIT(NULL, 0); struct fscrypt_str iname; @@ -424,19 +424,19 @@ int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname, if (!tname) { ret = fscrypt_fname_alloc_buffer(NAME_MAX, &_tname); if (ret) goto out_inode; - tname = &_tname; + tname = _tname.name; } - declen = ceph_base64_decode(name, name_len, tname->name); + declen = ceph_base64_decode(name, name_len, tname); if (declen <= 0) { ret = -EIO; goto out; } - iname.name = tname->name; + iname.name = tname; iname.len = declen; } else { iname.name = fname->ctext; iname.len = fname->ctext_len; } diff --git a/fs/ceph/crypto.h b/fs/ceph/crypto.h index 47e0c319fc68..a743620f308c 100644 --- a/fs/ceph/crypto.h +++ b/fs/ceph/crypto.h @@ -120,11 +120,11 @@ static inline void ceph_fname_free_buffer(struct inode *parent, { if (IS_ENCRYPTED(parent)) fscrypt_fname_free_buffer(fname); } -int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname, +int ceph_fname_to_usr(const struct ceph_fname *fname, unsigned char *tname, struct fscrypt_str *oname, bool *is_nokey); int ceph_fscrypt_prepare_readdir(struct inode *dir); static inline unsigned int ceph_fscrypt_blocks(u64 off, u64 len) { @@ -217,11 +217,11 @@ static inline void ceph_fname_free_buffer(struct inode *parent, struct fscrypt_str *fname) { } static inline int ceph_fname_to_usr(const struct ceph_fname *fname, - struct fscrypt_str *tname, + unsigned char *tname, struct fscrypt_str *oname, bool *is_nokey) { oname->name = fname->name; oname->len = fname->name_len; return 0; diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 00b9f9f3f4d7..75f0207bc9e8 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -442,15 +442,15 @@ static int parse_reply_info_readdir(void **p, void *end, info->dir_nr = num; while (num) { struct inode *inode = d_inode(req->r_dentry); struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_mds_reply_dir_entry *rde = info->dir_entries + i; - struct fscrypt_str tname = FSTR_INIT(NULL, 0); struct fscrypt_str oname = FSTR_INIT(NULL, 0); struct ceph_fname fname; u32 altname_len, _name_len; u8 *altname, *_name; + u8 *tname = NULL; /* dentry */ ceph_decode_32_safe(p, end, _name_len, bad); ceph_decode_need(p, end, _name_len, bad); _name = *p; @@ -494,11 +494,11 @@ static int parse_reply_info_readdir(void **p, void *end, * to do the base64_decode in-place. It's * safe because the decoded string should * always be shorter, which is 3/4 of origin * string. */ - tname.name = _name; + tname = _name; /* * Set oname to _name too, and this will be * used to do the dencryption in-place. */ @@ -511,11 +511,11 @@ static int parse_reply_info_readdir(void **p, void *end, */ oname.name = altname; oname.len = altname_len; } rde->is_nokey = false; - err = ceph_fname_to_usr(&fname, &tname, &oname, &rde->is_nokey); + err = ceph_fname_to_usr(&fname, tname, &oname, &rde->is_nokey); if (err) { pr_err("%s unable to decode %.*s, got %d\n", __func__, _name_len, _name, err); goto out_bad; } -- 2.34.1